Merch of the Year 2026 entry and website data processing
Note on language. This is an English translation provided for information. The legally binding version of this notice is the Hungarian one, available at Adatkezelési tájékoztató. In the event of any discrepancy between the two, the Hungarian version prevails.
This notice describes the processing of personal data carried out in connection with the use of the Merch of the Year 2026 website, entry, payment, judging, announcement of results and optional award communication. Accepting this notice is not a consent to data processing; on the entry form you confirm that you have read and understood it. Where consent is required, we ask for it separately, by a voluntary declaration.
1. The controller
Controller: DAIGE Korlátolt Felelősségű Társaság (DAIGE Kft.)
Registered seat: 1115 Budapest, Thallóczy Lajos utca 27., Hungary
Postal address: 1052 Budapest, Petőfi tér 3-5., 2nd floor 6., Hungary
Company registration number: 01-09-337355
Tax number: 26652975-2-43
Email: contact@obiristudio.com
Phone: +36 30 594 0601
OBIRI Studio is a brand name, not a separate controller. Data protection requests may be submitted using the contact details above. The Controller does not maintain a separate data protection officer contact.
2. Data subjects and sources of data
2.1. A data subject may be a visitor to the website; the representative or contact person of the Entrant; a person contributing to the project who is named or depicted in the entry materials; a jury member; and a natural person taking part in presenting the award.
2.2. Basic and billing data are normally provided by the data subject or by the Entrant employing them. Data of persons appearing in a presentation, image or video are supplied by the Entrant. The payment service provider transmits the result and identifier of the transaction; the Controller does not receive full bank card data.
2.3. Please do not upload special categories of personal data – such as health, biometric, political or religious data – unless it is strictly necessary and you have an appropriate legal basis for processing it. Please redact in advance any identifying or private data that is not required for judging.
3. Purpose, data, legal basis and duration of processing
3.1. Basic registration and conclusion of contract
Purpose: identifying the entry, keeping in contact, enabling payment of the fee, technical confirmation and formation of the contract.
Data: name of the entering organisation; name, email address and optional phone number of the contact person; time and version of declarations; entry and transaction identifiers; IP address and necessary security log data.
Legal basis: Article 6(1)(b) GDPR where the data subject is a sole trader or a contracting natural person; Article 6(1)(f) GDPR in the case of an organisational contact person. The legitimate interest is the effective conclusion and performance of the contract with the Entrant, and being able to evidence representation and contact data.
Retention: for unpaid or abandoned registrations, until the later of 30 days from submission and 30 days after the entry deadline; where a contract has been concluded, for 5 years from the announcement of the results, or in the event of a dispute until it is finally closed.
3.2. Project data, uploaded files and judging
Purpose: checking eligibility and formal requirements, requesting missing items, professional evaluation, handling conflicts of interest, and determining the shortlist and placements.
Data: name, category and description of the project; presentation; 3-15 photos; optional video or campaign link; names and roles of project contributors; the likeness of persons necessarily appearing in the files; jury scores, professional comments and the decision log.
Legal basis: performance of the entry contract under Article 6(1)(b) GDPR; Article 6(1)(f) GDPR for organisational contact persons and other persons appearing in the project materials. The legitimate interest is the evaluation of the submitted professional project and the credible, verifiable conduct of the award. The Entrant is required to inform the data subjects of this notice and to ensure that the submission is lawful.
Retention: complete, unpublished project files are kept for 90 days after the announcement of results and are then deleted, unless restricted retention is necessary because of a dispute, or a selected copy may be processed further on the basis of the communication permission under section 3.5. Individual jury access ends no later than 30 days after the announcement of results. The evaluation summary and decision log may be kept for 2 years, or in the event of a dispute until it is finally closed.
3.3. Payment, invoicing and accounting
Purpose: collecting the entry fee, reconciling payment, issuing invoices, and meeting accounting and tax obligations.
Data: billing name, address and tax number; email address; payment method, amount, time, status and transaction identifier; invoice data. The Controller does not process full card numbers, CVC codes or card authentication data.
Legal basis: performance of the contract until payment is reconciled; thereafter a legal obligation under Article 6(1)(c) GDPR, in particular under Act C of 2000 on Accounting and tax legislation.
Retention: accounting documents and their supporting data are kept for 8 years.
3.4. Announcement of results and professional archive
Purpose: the credible announcement of the shortlist and the winners, preserving the record of the award, and making the use of the award verifiable.
Data: name of the entering organisation; project name; category; shortlist or placement data; year. The name of a natural person appears only where it forms part of a creative credit and its publication is lawful.
Legal basis: performance of the contract, and the legitimate interest under Article 6(1)(f) GDPR in the publicity of the results of a professional award and in a credible archive. The data subject may object; a request for erasure is weighed against the historical and informational value of the result.
Retention: the minimum result data may remain in the professional archive of the award without a time limit, subject to regular review of necessity. Detailed project files do not fall within this scope.
3.5. Optional project communication
Purpose: presenting the project on the OBIRI Studio and award websites, on social media, in press materials, at events and in professional summaries.
Data: name of the Entrant and the project; description; selected extracts from the presentation; photos; videos; creative credits; likeness and name necessarily appearing in the content.
Legal basis: the separate copyright and communication permission given by the Entrant; consent under Article 6(1)(a) GDPR for the personal data of the person granting the permission or the contact person. We publish the likeness of another identifiable person only where the Entrant demonstrates that the data subject received appropriate information about such use by DAIGE Kft. and consented to it, or where publication is lawful on another, documented legal basis.
Retention: at most for the five-year term of the permission, or until consent relating to personal data is withdrawn. After withdrawal we remove the detailed material from our own digital surfaces within 30 days at the latest; previously lawful print and independent publication by a third party cannot always be recalled.
3.6. Complaints, legal claims and prevention of abuse
Purpose: investigating complaints, bringing or defending contractual and legal claims, and preventing and investigating fraud, unlawful files and IT incidents.
Data: the content of the complaint and correspondence; contractual, payment and technical data; the necessary project materials; IP address; timestamp; security logs.
Legal basis: Article 6(1)(f) GDPR. The legitimate interest is lawful operation, protection of our systems and of entry materials, and being able to evidence claims.
Retention: complaint and claim documents for 5 years as a rule; technical logs for a maximum of 6 months. In the case of a specific incident or dispute, the data concerned may be kept separately until the end of the limitation period following closure.
3.7. Newsletter and notification of future awards
The basic entry form does not constitute a newsletter subscription. Marketing messages may only be sent on the basis of separate, prior and voluntary consent. Should such an option be introduced later, the form must contain a separate checkbox and the message a simple way to unsubscribe. Name, email address, and the time and source of consent may be processed until withdrawal, but for no longer than 3 years from the last meaningful activity; evidence of withdrawal may be kept until legal claims become time-barred.
4. Mandatory and voluntary data
Without the entry, contact, project and billing data marked with an asterisk, an entry cannot be completed. A phone number is mandatory only where the form clearly indicates this. Communication use and newsletter consent are voluntary; refusing them may not affect the acceptance or judging of an entry.
5. Recipients and processors
5.1. Personal data may be accessed, only to the extent necessary for their tasks, by designated staff of DAIGE Kft., by jury members bound by confidentiality, and by the following categories of service provider:
| Recipient or category | Role and scope of data |
|---|---|
| Tárhely.Eu Szolgáltató Kft., 1144 Budapest, Ormánság utca 4. X/241., Hungary | hosting infrastructure and server operation; web form data, logs and files stored there |
| The payment service provider named on the payment page; where Stripe is used, Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland | processing payment; transaction and payer data; independent processing of card data |
| The invoicing system named on the billing page; where Billingo is used, Billingo Technologies Zrt. | electronic invoicing; billing and accounting document data |
| The file storage or transfer provider named on the upload page before any data is transferred | storage and transfer of presentations, images, links and access logs |
| The email service provider named in a system message or in an updated version of this notice | contact name and email address, delivery data of system messages |
| Jury members | evaluation of the project and the complete entry materials; separate, time-limited access |
| Accountant, auditor, legal or IT adviser | accounting, legal or incident-handling data necessary for their task, subject to confidentiality |
| Authority or court | only the data specified in a lawful, binding request |
5.2. If the upload or email provider is selected after this notice is published, the Controller will name it on the relevant page and update this notice before any data is first transferred. No provider may be used where the roles, data security, deletion and international transfer conditions are not settled by contract.
6. Transfers outside the European Economic Area
6.1. Hungarian hosting and invoicing services operate within the EEA as a rule. Certain international payment, file storage, email, analytics or social media providers may also process data outside the EEA, in particular in the United States.
6.2. Transfers to a third country may only take place in accordance with Chapter V of the GDPR: on the basis of a European Commission adequacy decision – in the case of the United States, only to a certified participant of the EU-US Data Privacy Framework – or with appropriate safeguards, such as European Commission standard contractual clauses together with any necessary supplementary measures. The privacy notice of the actual provider sets out the recipients and safeguards in detail.
7. Cookies and similar technologies
7.1. At the time version 1.0 of this document is published, only technologies necessary for the operation, security, load balancing and session handling of the website and the entry process, and for storing the chosen privacy setting, are treated as active.
7.2. The use of strictly necessary cookies or local storage is based on the legitimate interest under Article 6(1)(f) GDPR and on the exception recognised in Section 155(4) of Act C of 2003 on Electronic Communications for what is necessary to provide the requested service. These technologies may not be used for marketing or profiling purposes.
7.3. Analytics, conversion measurement, remarketing or social media technologies – including Google Analytics, Google Ads, Meta Pixel or the Meta Conversions API – may only be activated if:
the user has given prior, voluntary consent for each purpose;
refusing is just as easy as accepting;
no browser-side or server-side events are sent before consent;
the cookie settings interface names the provider, purpose, data, lifetime and means of withdrawal;
this notice has been updated with the actual technology and any international transfers.
7.4. Consent may be withdrawn at any time, as easily as it was given, via the “Cookie settings” interface. After withdrawal, non-essential tags and server-side event sending must stop. Cookies already placed can also be deleted in your browser settings.
8. Data security
8.1. The Controller applies measures proportionate to the risk, in particular encrypted HTTPS connections, role-based and individual access, strong authentication, regular updates and backups, access logging, time-limited revocation of permissions, screening for malicious files, and a documented deletion regime.
8.2. Project files must not be made available at publicly indexable or easily guessable links. Jury members may not download or forward materials more widely than necessary, and must delete their local copies when their access ends.
8.3. Complete freedom from risk cannot be guaranteed for data transmitted over the internet. In the event of a personal data breach, the Controller assesses the risk, documents it in accordance with Articles 33-34 GDPR, and where necessary notifies the Hungarian supervisory authority (NAIH) and the data subjects.
9. Automated decision-making
The professional evaluation of the award is carried out by people. No decision on the merits of an entry is taken solely by automated means with legal or similarly significant effects. Automated spam, file or payment checks may raise a technical flag, but human review can be requested in disputed cases.
10. Rights of the data subject
10.1. The data subject may request access to their personal data, their rectification, erasure or the restriction of their processing; data portability for data they have provided, processed by automated means on the basis of consent or a contract; and may object to processing based on legitimate interest and withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out beforehand.
10.2. Requests may be submitted to contact@obiristudio.com or to DAIGE Kft., 1052 Budapest, Petőfi tér 3-5., 2nd floor 6., Hungary. The Controller may only request proportionate additional data to verify identity.
10.3. The Controller responds without undue delay, as a rule within one month. This deadline may be extended by a further two months depending on the complexity and number of requests; notice with reasons is given within one month. Fulfilment is free of charge as a rule; for manifestly unfounded or excessively repetitive requests, the fee or refusal permitted by the GDPR may be applied.
10.4. Erasure and objection cannot override mandatory accounting retention, restricted retention necessary for legal claims, or another legal basis that takes precedence. The Controller gives reasons for any refusal and provides information on remedies.
11. Remedies
11.1. If the data subject considers the processing unlawful, they may contact the Controller directly, lodge a complaint with the supervisory authority, or turn to a court.
Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11., Hungary
Postal address: 1363 Budapest, Pf. 9., Hungary
Email: ugyfelszolgalat@naih.hu
Phone: +36 1 391 1400
Website: naih.hu
11.2. Judicial remedies are available under Articles 79 and 82 GDPR and under the Hungarian Information Act; proceedings may be brought before the competent tribunal under the applicable law.
12. Changes to this notice
12.1. The Controller amends this notice where the process, the service providers, the measurement technology or the law changes. The version in force is available on the website with a version number and effective date.
12.2. Data subjects must be informed, using the contact details available, of any change that materially affects the purpose or legal basis of data already collected; a new purpose requiring consent requires new consent.